---METADATA---
VENDOR: Yamcs
PRODUCT: Yamcs
AFFECTED_VERSIONS: < 5.12.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A code injection vulnerability in the Yamcs mission control framework allows unauthenticated attackers to execute arbitrary OS commands via the Nashorn ScriptEngine.

Executive Summary:
A critical code injection vulnerability in Yamcs allows unauthenticated remote attackers to execute arbitrary system commands, posing a total compromise risk to the host environment.

Vulnerability Details

CVE-ID: CVE-2026-46562

Affected Software: Yamcs Yamcs

Affected Versions: < 5.12.7

Vulnerability: The vulnerability exists because the Nashorn ScriptEngine fails to implement a ClassFilter when processing user-supplied JavaScript algorithms. This allows an unauthenticated attacker to inject malicious code that invokes arbitrary Java classes, resulting in OS command execution as the Yamcs process.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the Yamcs process and the underlying host system. Given the CVSS score of 9.8, this represents an extreme risk, enabling data theft, lateral movement, or complete system destruction.

Remediation Plan

Immediate Action: Upgrade the Yamcs installation to version 5.12.7 or 5.13.0 immediately. These versions disable algorithm editing by default and implement the necessary security filters.

Proactive Monitoring: Review application logs for unauthorized calls to the MdbOverrideApi endpoint or suspicious JavaScript activity within algorithm definitions.

Compensating Controls: If immediate patching is not feasible, restrict network access to the Yamcs management interface using a Web Application Firewall or network segmentation to prevent external access.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the combination of unauthenticated access and the ability to bridge JavaScript execution into native Java system calls.

Analyst Recommendation

This vulnerability is critical and requires immediate attention to prevent unauthorized system access. Administrators should prioritize the deployment of the vendor-provided patch to remediate the unsafe evaluation of dynamic code.

---METADATA---
VENDOR: Plane
PRODUCT: Plane
AFFECTED_VERSIONS: Prior to version 1.3.1
---END_METADATA---

Description Summary:
A cross-workspace asset authorization bypass exists in Plane, allowing authenticated users to read, copy, delete, and overwrite assets in other workspaces.

Executive Summary:
An authorization bypass vulnerability in the Plane project management tool allows authenticated users to illicitly access and modify assets across unauthorized workspaces.

Vulnerability Details

CVE-ID: CVE-2026-46558

Affected Software: Plane

Affected Versions: Prior to version 1.3.1

Vulnerability: This is an authorization bypass vulnerability occurring within the asset management functionality. It allows any authenticated user to interact with assets in workspaces they do not own or have permission to access, essentially negating workspace isolation.

Business Impact

With a CVSS score of 8.3, this high-severity vulnerability poses a significant risk to organizational data integrity and confidentiality. Successful exploitation could lead to unauthorized data exfiltration, the deletion of critical project documentation, or the overwriting of sensitive assets, potentially resulting in severe operational disruption and loss of intellectual property.

Remediation Plan

Immediate Action: Upgrade your Plane installation to version 1.3.1 or later immediately to apply the necessary authorization checks.

Proactive Monitoring: Review application access logs for unusual patterns of asset interaction, particularly requests targeting workspace IDs associated with other teams or projects.

Compensating Controls: Ensure strict role-based access control (RBAC) policies are enforced at the network level and consider placing the instance behind a WAF to detect anomalous API requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for an authenticated user to bypass workspace boundaries constitutes a critical failure in logical access control. Organizations utilizing Plane must prioritize upgrading to version 1.3.1 to ensure workspace integrity and prevent unauthorized cross-workspace data manipulation.

---METADATA---
VENDOR: Kubernetes
PRODUCT: mcp-server-kubernetes
AFFECTED_VERSIONS: Prior to version 3.6.0
---END_METADATA---

Description Summary:
An access control bypass in mcp-server-kubernetes allows clients to invoke Kubernetes operations directly, bypassing tool discovery restrictions.

Executive Summary:
A failure in access control enforcement within the mcp-server-kubernetes tool allows unauthorized execution of sensitive cluster management commands.

Vulnerability Details

CVE-ID: CVE-2026-46519

Affected Software: Kubernetes mcp-server-kubernetes

Affected Versions: Prior to version 3.6.0

Vulnerability: The project enforces environment variables intended to restrict Kubernetes operations only at the tool discovery layer (tools/list). It fails to enforce these same restrictions at the execution layer (tools/call), allowing any client that knows the name of a restricted tool to invoke it directly.

Business Impact

With a CVSS score of 8.8, this is a critical security failure. If an attacker gains access to the MCP server, they can execute unauthorized Kubernetes cluster management operations. This could lead to the deletion of resources, unauthorized access to secrets, or full cluster compromise, significantly impacting the stability and security of the entire infrastructure.

Remediation Plan

Immediate Action: Upgrade to mcp-server-kubernetes version 3.6.0 or later to ensure that security restrictions are properly enforced during the tool execution phase.

Proactive Monitoring: Audit Kubernetes API server logs for unexpected or unauthorized tool execution calls originating from the MCP server.

Compensating Controls: Implement strict network policies and RBAC for the MCP server itself, ensuring that only authenticated and authorized entities can communicate with the server endpoint.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Access control failures at the execution level are extremely dangerous in infrastructure management tools. Administrators must ensure that security logic is applied consistently across all request pathways and should prioritize the update to version 3.6.0 immediately.

---METADATA---
VENDOR: mwtcmi
PRODUCT: frogman
AFFECTED_VERSIONS: < 1.6.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization vulnerability in mwtcmi frogman allows authenticated users with low-level permissions to access sensitive system secrets and execute unauthorized administrative commands.

Executive Summary:
An authenticated missing authorization vulnerability in mwtcmi frogman enables low-privileged users to exfiltrate critical system credentials and execute administrative functions.

Vulnerability Details

CVE-ID: CVE-2026-46515

Affected Software: mwtcmi frogman

Affected Versions: < 1.6.3

Vulnerability: The application fails to perform adequate authorization checks for multiple API functions, allowing users with PERM_READ access to invoke sensitive endpoints. This flaw exposes sensitive data, including Asterisk dialplan contexts, SSH commands, and raw SIP credentials.

Business Impact

The exploitation of this vulnerability allows unauthorized access to sensitive configuration and authentication data. With a CVSS score of 9.3, the impact is critical: it facilitates full system compromise, potential lateral movement within the telephony infrastructure, and the exposure of proprietary communication data.

Remediation Plan

Immediate Action: Upgrade mwtcmi frogman to version 1.6.3 or later to apply the necessary authorization checks.

Proactive Monitoring: Review access logs for unusual patterns of API calls, specifically monitoring for repeated invocations of administrative functions by low-privileged user accounts.

Compensating Controls: Implement strict network segmentation to limit access to the frogman API to known, trusted management workstations only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw stems from a fundamental failure to enforce access controls on sensitive API endpoints, making it highly susceptible to exploitation by any authenticated user.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators must prioritize updating to version 1.6.3 to close the authorization gap and prevent the exfiltration of sensitive credentials and configuration data.

---METADATA---
VENDOR: mwtcmi
PRODUCT: Frogman
AFFECTED_VERSIONS: < 1.6.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An input validation flaw in the Frogman PBX control software allows authenticated users with writing privileges to inject arbitrary Asterisk directives.

Executive Summary:
A critical code injection vulnerability in Frogman allows authenticated attackers to execute arbitrary Asterisk commands, potentially leading to full control over PBX operations.

Vulnerability Details

CVE-ID: CVE-2026-46512

Affected Software: mwtcmi Frogman

Affected Versions: < 1.6.2

Vulnerability: The application fails to properly sanitize template parameters used in dialplan configuration. An authenticated user possessing PERM_WRITE capabilities can exploit this to inject malicious directives such as System or SHELL into the Asterisk configuration files.

Business Impact

Exploitation allows an attacker to manipulate PBX functionality, potentially intercepting communications, rerouting calls, or executing OS-level commands through Asterisk. With a CVSS score of 9.9, this vulnerability poses a severe threat to the integrity and confidentiality of voice infrastructure.

Remediation Plan

Immediate Action: Upgrade to Frogman version 1.6.2 to resolve the sanitization failures in the dialplan application logic.

Proactive Monitoring: Monitor Asterisk configuration files for unexpected changes or the inclusion of unauthorized directives. Audit user permissions to ensure only authorized personnel have write access to dialplan templates.

Compensating Controls: Implement strict role-based access controls to limit the number of users with PERM_WRITE privileges until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires authenticated access, the ability to escape into the Asterisk shell environment makes this a high-impact vector.

Analyst Recommendation

The severity of this issue necessitates an immediate update to the latest version of Frogman. Security teams should verify that all write-capable user accounts are strictly managed to minimize the risk of internal or credential-based abuse.

---METADATA---
VENDOR: SimpleSAMLphp
PRODUCT: casserver
AFFECTED_VERSIONS: Prior to version 7.0.3
---END_METADATA---

Description Summary:
A path traversal vulnerability in the SimpleSAMLphp-casserver allows attackers to read and potentially execute arbitrary code via malicious file-based ticket manipulation.

Executive Summary:
The SimpleSAMLphp-casserver module is vulnerable to path traversal and remote code execution, requiring an immediate update to version 7.0.3.

Vulnerability Details

CVE-ID: CVE-2026-46491

Affected Software: SimpleSAMLphp-casserver

Affected Versions: Prior to version 7.0.3

Vulnerability: The vulnerability stems from improper input validation and path construction in the file-based ticket storage. Attackers can use path traversal sequences like ../target.serialized to read and unserialize files outside the intended directory, facilitating remote code execution.

Business Impact

The CVSS score of 8.6 reflects the severe risk of remote code execution, which could allow an attacker to gain full control over the underlying server. This could lead to a complete compromise of authentication services, data exfiltration, and significant reputational damage to organizations relying on this CAS implementation.

Remediation Plan

Immediate Action: Update the SimpleSAMLphp-casserver module to version 7.0.3 or higher immediately.

Proactive Monitoring: Monitor server logs for suspicious file access patterns, particularly those involving directory traversal sequences or attempts to access serialized files outside the designated ticket storage directory.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block path traversal attempts and suspicious serialized data patterns.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 11, 2026, public exploitation information is available for this vulnerability. Organizations should treat this as a high-priority incident and apply patches immediately.

Analyst Recommendation

The presence of a public exploit significantly increases the risk of active targeting. Security teams should prioritize patching this vulnerability immediately to prevent unauthorized access and potential system takeover.

---METADATA---
VENDOR: Samlify
PRODUCT: Samlify
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the Samlify Node.js library, which is commonly used for SAML authentication.

Executive Summary:
A critical security flaw in the Samlify Node.js library threatens the integrity of SAML-based authentication mechanisms in integrated applications.

Vulnerability Details

CVE-ID: CVE-2026-46490

Affected Software: Samlify (Node.js library)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability impacts the Samlify library, a tool for handling SAML assertions in Node.js applications. The flaw potentially compromises the authentication flow, which could allow for identity spoofing or authentication bypass depending on the implementation.

Business Impact

As Samlify is used to manage authentication, a vulnerability here puts the security of all connected applications at risk. A CVSS score of 8.8 highlights the possibility of unauthorized access to protected resources, which could lead to widespread data exposure across the enterprise.

Remediation Plan

Immediate Action: Update the Samlify library dependency in all Node.js projects to the version specified by the vendor as containing the fix.

Proactive Monitoring: Monitor authentication logs for suspicious login patterns or irregular SAML assertion failures.

Compensating Controls: Implement additional validation checks for SAML assertions at the application level as a secondary layer of defense.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the central role of authentication libraries, developers and security teams must treat this update as a high priority. Ensure that all applications utilizing the Samlify library are patched and tested to maintain the integrity of user identity management.

---METADATA---
VENDOR: SolidInvoice
PRODUCT: SolidInvoice
AFFECTED_VERSIONS: SolidInvoice up to 2.3.16
---END_METADATA---

Description Summary:
An authenticated administrator in SolidInvoice can upload an SVG file containing embedded JavaScript, resulting in stored cross-site scripting (XSS).

Executive Summary:
A stored XSS vulnerability in SolidInvoice allows an authenticated administrator to execute malicious scripts in the browsers of other users.

Vulnerability Details

CVE-ID: CVE-2026-46489

Affected Software: SolidInvoice

Affected Versions: SolidInvoice up to 2.3.16

Vulnerability: The application fails to properly sanitize SVG file uploads. An authenticated administrator can upload an SVG file containing malicious JavaScript, which is then stored and executed in the browser of any user who views the file.

Business Impact

With a CVSS score of 8.1, this vulnerability poses a significant risk to the integrity of user sessions. An attacker can use this XSS to steal session cookies, capture administrative credentials, or perform unauthorized actions on behalf of other users, leading to potential data breach and administrative account compromise.

Remediation Plan

Immediate Action: Upgrade SolidInvoice to version 2.3.17 or later to implement strict file upload sanitization.

Proactive Monitoring: Review audit logs for suspicious file uploads and monitor for anomalous browser behavior among administrative users.

Compensating Controls: Implement a Content Security Policy (CSP) that restricts script execution and prevents the loading of unauthorized scripts from uploaded files.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This stored XSS vulnerability grants significant leverage to an attacker who has already gained administrative access. Updating to version 2.3.17 is essential to prevent the execution of malicious scripts and protect the organization's user base from cross-site scripting attacks.

---METADATA---
VENDOR: Lissy93
PRODUCT: Dashy
AFFECTED_VERSIONS: < 4.0.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dashy contains a vulnerability allowing for improper access control and authentication, which may lead to unauthorized system configuration changes.

Executive Summary:
An improper access control vulnerability in Lissy93 Dashy versions prior to 4.0.8 poses a high risk of unauthorized configuration manipulation.

Vulnerability Details

CVE-ID: CVE-2026-46485

Affected Software: Lissy93 Dashy

Affected Versions: < 4.0.8

Vulnerability: This vulnerability involves improper authentication and access control mechanisms, allowing unauthenticated attackers to potentially modify system settings or configurations.

Business Impact

The ability for an unauthenticated attacker to alter dashboard configurations can lead to severe operational disruption or the exposure of sensitive internal service references. With a CVSS score of 8.2, this high-severity flaw represents a significant risk to the integrity and availability of the self-hosted dashboard environment.

Remediation Plan

Immediate Action: Update Dashy to version 4.0.8 or later immediately to resolve the authentication and access control flaws.

Proactive Monitoring: Review system configuration files for unexpected changes and monitor access logs for unauthorized attempts to reach administrative endpoints.

Compensating Controls: Restrict network access to the Dashy instance using a VPN or IP allowlisting at the firewall level to prevent external, unauthenticated exposure.

Exploitation Status

Public Exploit Available: No confirmed public exploit in the available data.

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature, which allows for remote control over configuration settings.

Analyst Recommendation

Given the high CVSS score and the nature of the vulnerability, administrators must prioritize patching this system. Please apply the 4.0.8 update as soon as possible to prevent potential unauthorized access and configuration tampering.

---METADATA---
VENDOR: Headplane
PRODUCT: Headplane Web UI
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Headplane Web UI for Headscale, which may permit unauthorized access or impact the management of the network overlay.

Executive Summary:
A high-severity vulnerability in the Headplane management interface could allow unauthorized actors to manipulate network configurations.

Vulnerability Details

CVE-ID: CVE-2026-46484

Affected Software: Headplane Web UI

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides in the Web UI layer, likely involving an authentication or access control bypass that permits an attacker to perform administrative actions without valid credentials.

Business Impact

The CVSS score of 8.1 highlights the risk of unauthorized management of network infrastructure. Since Headplane interfaces with Headscale (a Tailscale-compatible controller), an exploit could allow an attacker to disrupt network connectivity, add unauthorized nodes, or access sensitive network metadata, causing widespread operational disruption.

Remediation Plan

Immediate Action: Apply the latest security updates released by the Headplane maintainers immediately.

Proactive Monitoring: Monitor logs for unauthorized login attempts or unexpected modifications to the network state, such as newly registered nodes that were not authorized by the administrator.

Compensating Controls: Implement strict network segmentation to ensure the Headplane UI is not exposed to the public internet, requiring a VPN or proxy with authentication for access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of network management tools, it is imperative to mitigate this vulnerability promptly. Administrators should verify their current version and apply patches immediately to prevent potential unauthorized access to the network control plane.

---METADATA---
VENDOR: OpenMetadata
PRODUCT: OpenMetadata Platform
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been disclosed in the OpenMetadata unified metadata platform, potentially impacting system security and data integrity.

Executive Summary:
A critical security flaw within the OpenMetadata platform exposes the environment to unauthorized access, necessitating immediate administrative review.

Vulnerability Details

CVE-ID: CVE-2026-46481

Affected Software: OpenMetadata Platform

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the core functionality of the metadata platform, likely involving improper authorization checks that could permit unauthorized actors to interact with sensitive metadata or administrative functions.

Business Impact

With a CVSS score of 8.3, this vulnerability represents a significant risk to data governance environments. Unauthorized access to metadata platforms can lead to the exposure of sensitive data structures, business intelligence configurations, and internal system architectures, potentially facilitating further lateral movement within the network.

Remediation Plan

Immediate Action: Update the OpenMetadata deployment to the latest version provided by the vendor to address the underlying security defect.

Proactive Monitoring: Conduct a thorough audit of user authentication logs and monitor for unusual API activity or unauthorized configuration changes within the platform.

Compensating Controls: Restrict network access to the OpenMetadata interface to trusted IP ranges and ensure all administrative interfaces are protected by multi-factor authentication (MFA).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this issue demands immediate attention. System administrators should prioritize testing and deploying the latest vendor updates in non-production environments before rolling them out to production to maintain the integrity of their data metadata infrastructure.

---METADATA---
VENDOR: FlowiseAI
PRODUCT: Flowise
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in the Flowise drag-and-drop user interface used for building Large Language Model (LLM) flows.

Executive Summary:
A high-severity vulnerability in the Flowise LLM workflow interface poses a significant risk to organizations utilizing this platform for AI automation.

Vulnerability Details

CVE-ID: CVE-2026-46480

Affected Software: FlowiseAI Flowise

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the Flowise interface, which is used for creating customized LLM flows. While specific technical details are limited, the severity score of 8.8 indicates a significant security deficiency potentially allowing for unauthorized access or code execution.

Business Impact

Compromise of the Flowise interface could allow attackers to manipulate LLM workflows, potentially leading to unauthorized data exfiltration, injection of malicious prompts, or disruption of AI-driven business processes. A CVSS score of 8.8 necessitates immediate attention to prevent the abuse of sensitive LLM integrations.

Remediation Plan

Immediate Action: Check the vendor's official documentation for the latest release and update the Flowise instance to the recommended secure version.

Proactive Monitoring: Review access logs for the Flowise dashboard and monitor for unusual workflow configurations or unauthorized project modifications.

Compensating Controls: Place the Flowise interface behind a reverse proxy or VPN with strict authentication requirements to minimize exposure to untrusted networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations integrating Flowise into their production pipelines should treat this vulnerability as urgent. Apply available patches immediately and audit existing LLM flows for any signs of tampering or unauthorized configuration changes.

---METADATA---
VENDOR: Flowise
PRODUCT: Flowise
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists within the Flowise drag-and-drop interface used for building customized large language model flows.

Executive Summary:
A high-severity vulnerability in the Flowise LLM workflow platform poses a significant risk to the integrity and confidentiality of integrated data environments.

Vulnerability Details

CVE-ID: CVE-2026-46479

Affected Software: Flowise Flowise

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Flowise interface. Users should assume that any flaw in this component requires prompt remediation to prevent unauthorized access or system-level exploitation.

Business Impact

A CVSS score of 8.8 warrants immediate remediation efforts to prevent potential compromise of the Flowise environment. Failure to address this could lead to unauthorized access to sensitive data processed by the LLM, resulting in severe operational or reputational damage.

Remediation Plan

Immediate Action: Ensure the installation is updated to the latest vendor-provided release.

Proactive Monitoring: Maintain detailed logs of all administrative actions within the Flowise interface to identify any unauthorized configuration changes.

Compensating Controls: Restrict access to the Flowise management interface to authorized personnel only via VPN or secure gateway solutions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity, it is imperative to maintain a proactive posture by applying updates as soon as they become available. Regularly auditing the security configuration of the Flowise environment is recommended to minimize the attack surface.

---METADATA---
VENDOR: Flowise
PRODUCT: Flowise
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists within the Flowise drag-and-drop interface used for building customized large language model flows.

Executive Summary:
A high-severity vulnerability in the Flowise LLM workflow platform poses a significant risk to the integrity and confidentiality of integrated data environments.

Vulnerability Details

CVE-ID: CVE-2026-46478

Affected Software: Flowise Flowise

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an issue within the Flowise workflow interface. As with related entries, the flaw requires immediate attention to prevent unauthorized interaction with LLM orchestration components.

Business Impact

With a CVSS score of 8.8, this vulnerability indicates a high potential for impact, potentially allowing attackers to compromise LLM flow integrity. This could lead to unauthorized data processing or the injection of malicious instructions into the language model pipelines.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the vendor immediately upon release to address the underlying vulnerability.

Proactive Monitoring: Monitor application logs for anomalous activity, particularly actions related to workflow creation or modification by non-authorized users.

Compensating Controls: Utilize Web Application Firewalls (WAF) to monitor and block potentially malicious payload structures targeting the Flowise interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this vulnerability with high urgency. Ensure that the Flowise instance is not exposed to untrusted networks and apply all vendor-supplied patches promptly to secure the LLM infrastructure.

---METADATA---
VENDOR: Flowise
PRODUCT: Flowise
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists within the Flowise drag-and-drop interface used for building customized large language model flows.

Executive Summary:
A high-severity vulnerability in the Flowise LLM workflow platform poses a significant risk to the integrity and confidentiality of integrated data environments.

Vulnerability Details

CVE-ID: CVE-2026-46477

Affected Software: Flowise Flowise

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an issue within the Flowise workflow interface. While specific authentication requirements are currently pending further disclosure, similar flaws in low-code platforms often permit unauthorized execution or data access.

Business Impact

Successful exploitation of this flaw could result in unauthorized access to sensitive LLM data pipelines or the manipulation of workflow logic. Given the CVSS score of 8.8, this vulnerability represents a high risk that could lead to significant data exfiltration or service disruption if attackers gain control over LLM orchestration.

Remediation Plan

Immediate Action: Update the Flowise deployment to the latest version provided by the vendor as soon as an official security patch is released.

Proactive Monitoring: Review system and application access logs for unusual traffic patterns or unauthorized API requests directed at the Flowise interface.

Compensating Controls: Implement strict network access controls and utilize a Web Application Firewall (WAF) to filter suspicious requests targeting the workflow builder.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Flowise must prioritize the monitoring of vendor security channels for patch availability. Due to the high CVSS score, it is recommended to isolate the service from public-facing networks until a verified update is applied to mitigate the risk of unauthorized workflow manipulation.

---METADATA---
VENDOR: Flowise
PRODUCT: Flowise
AFFECTED_VERSIONS: Flowise versions prior to 3.1.2
---END_METADATA---

Description Summary:
A mass assignment vulnerability in Flowise allows an authenticated user to take over custom templates belonging to other workspaces.

Executive Summary:
A high-severity mass assignment vulnerability in Flowise allows authenticated users to hijack other users' custom templates, potentially compromising proprietary LLM workflows.

Vulnerability Details

CVE-ID: CVE-2026-46476

Affected Software: Flowise

Affected Versions: Prior to 3.1.2

Vulnerability: This is a mass assignment flaw where any authenticated user with edit permissions can reassign a custom template to any workspace by guessing or enumerating the workspace UUID. This allows for unauthorized modification or theft of custom LLM flow configurations.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a significant risk to the integrity of AI-driven business processes. Unauthorized access to custom LLM templates can lead to the exposure of sensitive logic, intellectual property theft, or the injection of malicious prompts into corporate workflows.

Remediation Plan

Immediate Action: Upgrade Flowise to version 3.1.2 or later to address the mass assignment vulnerability.

Proactive Monitoring: Review access logs for unusual workspace modification requests or unauthorized enumeration of UUIDs.

Compensating Controls: Implement strict access control policies and ensure that workspace identifiers are not exposed in client-side responses or predictable formats.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 16, 2026, a public exploit is available. The relative ease of enumerating UUIDs makes this a high-priority risk for all Flowise deployments.

Analyst Recommendation

The combination of a mass assignment flaw and a public exploit makes this a critical security concern. Organizations should update their Flowise installations immediately and audit existing workspace configurations to ensure no templates have been subject to unauthorized reassignment.

---METADATA---
VENDOR: Flowise
PRODUCT: Flowise
AFFECTED_VERSIONS: Prior to version 3.1.2
---END_METADATA---

Description Summary:
A mass-assignment vulnerability in Flowise allows authenticated users to move assistants between workspaces, resulting in cross-workspace takeover.

Executive Summary:
A mass-assignment flaw in the Flowise platform allows authenticated users to hijack assistants from other workspaces, leading to unauthorized data access and flow manipulation.

Vulnerability Details

CVE-ID: CVE-2026-46475

Affected Software: Flowise

Affected Versions: Prior to version 3.1.2

Vulnerability: This is a mass-assignment vulnerability occurring during the creation or update of assistants. By manipulating the workspaceId in a PUT request, an authenticated user can reassign an assistant to a workspace they control.

Business Impact

With a CVSS score of 8.8, this vulnerability allows for significant unauthorized access within multi-tenant or collaborative environments. The potential for cross-workspace takeover could result in the compromise of sensitive LLM flows and proprietary data, severely impacting organizational security posture.

Remediation Plan

Immediate Action: Update the Flowise platform to version 3.1.2 or later to correct the mass-assignment vulnerability.

Proactive Monitoring: Review access and API logs for unusual PUT requests or unauthorized attempts to modify workspace associations.

Compensating Controls: Implement strict role-based access control (RBAC) and validate that users only have permissions within their intended workspace to limit the impact of such flaws.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to manipulate workspace associations represents a critical authorization bypass. Administrators must update to the latest version immediately to ensure that workspace isolation is properly enforced and to prevent unauthorized access to sensitive LLM flows.

---METADATA---
VENDOR: TCHATZI
PRODUCT: Authen::TOTP
AFFECTED_VERSIONS: 0 up to (excluding) 0.1.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Authen::TOTP Perl module contains a vulnerability related to insufficient entropy, which may weaken the security of generated Time-based One-Time Passwords.

Executive Summary:
A vulnerability in the Authen::TOTP library involving insufficient entropy potentially allows for the prediction of authentication tokens, undermining multi-factor security controls.

Vulnerability Details

CVE-ID: CVE-2026-46473

Affected Software: TCHATZI Authen::TOTP

Affected Versions: 0 up to (excluding) 0.1.1

Vulnerability: This vulnerability (CWE-331) stems from insufficient entropy during token generation. It is an unauthenticated vulnerability, as it affects the underlying cryptographic strength of the TOTP implementation itself.

Business Impact

If the TOTP tokens generated by this library are predictable, an attacker could potentially bypass multi-factor authentication (MFA) mechanisms that rely on this module. This could lead to unauthorized account access, identity theft, and the compromise of any systems protected by the affected MFA implementation. The CVSS score of 7.5 highlights the significant threat to authentication integrity.

Remediation Plan

Immediate Action: Upgrade the Authen::TOTP module to version 0.1.1 or later to ensure cryptographically secure token generation.

Proactive Monitoring: Review authentication logs for patterns suggesting brute-force or prediction-based attempts against MFA-protected accounts.

Compensating Controls: Where possible, verify if the implementation allows for alternative, cryptographically stronger TOTP libraries until the update can be applied.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically concerning due to the critical role of TOTP in modern security architectures.

Analyst Recommendation

The reliance on predictable tokens negates the primary purpose of multi-factor authentication. IT teams using the Authen::TOTP module must treat this as a high-priority update to restore the integrity of their authentication systems and prevent potential account takeovers.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Camel
AFFECTED_VERSIONS: 4.0.0 up to 4.14.8, 4.15.0 up to 4.18.3, 4.19.0 up to 4.21.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper input validation vulnerability exists in the Apache Camel NATS component, which may allow for unauthorized data processing.

Executive Summary:
An unauthenticated input validation vulnerability in the Apache Camel NATS component creates a significant risk of unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-46457

Affected Software: Apache Software Foundation Apache Camel

Affected Versions: 4.0.0 up to 4.14.8, 4.15.0 up to 4.18.3, 4.19.0 up to 4.21.0

Vulnerability: The NATS component fails to perform adequate input validation. This enables an unauthenticated attacker to send crafted inputs that the component may process improperly, leading to potential integrity compromise.

Business Impact

The CVSS score of 7.5 reflects the high risk posed by this vulnerability. Successful exploitation could allow an attacker to inject unauthorized messages or data into the NATS infrastructure, potentially disrupting business processes or altering the state of downstream systems that rely on Camel-processed data.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches for the Apache Camel NATS component immediately.

Proactive Monitoring: Review NATS message traffic and application logs for unusual input patterns or unexpected message payloads that do not conform to expected schema formats.

Compensating Controls: Utilize message authentication and validation proxies to filter incoming traffic to the NATS component until the underlying software can be patched.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Input validation flaws are common vectors for system disruption. Organizations should prioritize the application of the vendor's security update to ensure that the NATS component correctly handles input, thereby maintaining the integrity of the data stream.

---METADATA---
VENDOR: Apache
PRODUCT: Camel
AFFECTED_VERSIONS: 4.0.0 before 4.14.8, 4.15.0 before 4.18.3, 4.19.0 before 4.21.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Improper input validation in the Apache Camel AWS2-SQS component allows attackers to inject arbitrary control headers, potentially hijacking downstream route behavior.

Executive Summary:
An input validation flaw in the Apache Camel AWS2-SQS component allows attackers to inject Camel control headers, leading to unauthorized manipulation of downstream application logic.

Vulnerability Details

CVE-ID: CVE-2026-46456

Affected Software: Apache Camel

Affected Versions: 4.0.0 before 4.14.8, 4.15.0 before 4.18.3, 4.19.0 before 4.21.0

Vulnerability: The camel-aws2-sqs component fails to filter inbound message attributes, allowing attackers who can send messages to the SQS queue to inject internal control headers. These headers are then processed by downstream producers, potentially redirecting HTTP requests or altering file operations.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk to service integrity and data flow control. By manipulating headers, an attacker can effectively hijack the application's logic, leading to unauthorized data access, file system tampering, or redirection of sensitive traffic to external endpoints.

Remediation Plan

Immediate Action: Upgrade to version 4.21.0, or the applicable LTS stream version (4.14.8 or 4.18.3), which introduces mandatory inbound header filtering.

Proactive Monitoring: Monitor application logs for evidence of unexpected header values or abnormal route behavior. Review SQS access patterns for unauthorized senders.

Compensating Controls: If patching is delayed, explicitly remove all Camel* and camel* headers at the start of the routing process using removeHeaders and enforce strict sqs:SendMessage permissions on the queue.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly exploitable if the SQS queue is accessible to untrusted parties. Organizations must prioritize the update to ensure that inbound headers are correctly sanitized, neutralizing the ability for attackers to control internal routing logic.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Camel
AFFECTED_VERSIONS: 4.18.0 to 4.18.2, 4.19.0 to 4.20.x
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Apache Camel Keycloak component fails to properly validate token expiration and 'not-before' claims, allowing the acceptance of expired or invalid access tokens.

Executive Summary:
An authentication flaw in the Apache Camel Keycloak component allows the use of expired or invalid tokens, potentially granting unauthorized access to protected routes.

Vulnerability Details

CVE-ID: CVE-2026-46455

Affected Software: Apache Software Foundation Apache Camel

Affected Versions: 4.18.0 through 4.18.2, 4.19.0 through 4.20.x

Vulnerability: The 'KeycloakSecurityHelper' fails to invoke the 'IS_ACTIVE' predicate during token verification, meaning the system validates the signature but ignores the token's expiration (exp) and 'not-before' (nbf) claims. This represents an authentication bypass scenario where unauthenticated attackers can reuse expired tokens to gain persistent unauthorized access.

Business Impact

This vulnerability undermines the entire authentication mechanism for applications relying on the Keycloak integration. With a CVSS score of 9.8, the potential for unauthorized access, data compromise, and full system impact is extreme, as an attacker can maintain access long after a session should have expired.

Remediation Plan

Immediate Action: Apply the vendor-provided security update by upgrading to version 4.21.0 or 4.18.3.

Proactive Monitoring: Audit application logs for patterns of session reuse and verify if incoming requests are being accepted with tokens that have exceeded their intended lifetime.

Compensating Controls: For systems that cannot be immediately patched, enforce strict token expiration checks within the application route logic and ensure that upstream API gateways perform comprehensive token validation.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Authentication bypass vulnerabilities of this nature are critical and require immediate remediation. Security teams must ensure that all instances of the affected Camel Keycloak component are updated to prevent the use of invalid or expired credentials.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Camel
AFFECTED_VERSIONS: 4.0.0-4.14.7, 4.15.0-4.18.2, 4.19.0-4.20.x
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Apache Camel Cometd component is vulnerable to improper input validation, allowing unauthenticated remote attackers to inject control headers and influence downstream route behavior.

Executive Summary:
Apache Camel is vulnerable to an unauthenticated header injection flaw that allows attackers to manipulate message routing and internal control headers.

Vulnerability Details

CVE-ID: CVE-2026-46454

Affected Software: Apache Camel (Cometd Component)

Affected Versions: 4.0.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.x

Vulnerability: The vulnerability exists because inbound Bayeux message headers are mapped into the Camel Exchange without adequate filtering. An unauthenticated attacker can inject arbitrary control headers, which are then processed by downstream route components.

Business Impact

The ability to manipulate internal control headers allows an attacker to redirect HTTP traffic, alter file processing destinations, or override JMS destinations. The CVSS score of 9.8 highlights the critical risk, as this can lead to data exfiltration, service disruption, or unauthorized processing of sensitive information depending on the route configuration.

Remediation Plan

Immediate Action: Upgrade to Apache Camel version 4.21.0, 4.14.8, or 4.18.3 depending on the specific release stream in use.

Proactive Monitoring: Monitor application logs for unexpected header configurations or anomalous routing behavior within Camel routes.

Compensating Controls: For systems that cannot be patched immediately, implement a HeaderFilterStrategy to strip "Camel*" and "camel*" headers, and enforce Bayeux SecurityPolicies to require authentication for all clients.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity of message routing logic. It is recommended that organizations prioritize upgrading to the specified patched versions to ensure that header filtering is correctly enforced and to prevent potential unauthorized control of Camel routes.

---METADATA---
VENDOR: GitHub
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, technical_details
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:42.555Z
---END_METADATA---

Description Summary:
A security flaw has been identified within multiple GitHub products. The nature of the vulnerability remains unspecified, requiring immediate attention to vendor documentation for remediation.

Executive Summary:
A security vulnerability affecting multiple GitHub products has been identified, which may pose a significant risk to the integrity and confidentiality of development environments.

Vulnerability Details

CVE-ID: CVE-2026-4645

Affected Software: GitHub Multiple Products

Affected Versions: See vendor advisory

Vulnerability: The vulnerability details are currently insufficient to define the specific flaw or the required authentication level for exploitation. Given the lack of technical disclosure, administrators must treat all GitHub-hosted assets as potentially exposed until further information is released.

Business Impact

The potential impact of this vulnerability is high, as evidenced by the CVSS score of 7.5. Successful exploitation could lead to unauthorized access to repositories, compromise of sensitive source code, or the unauthorized modification of software supply chain pipelines, resulting in severe reputational damage and operational disruption.

Remediation Plan

Immediate Action: Monitor official GitHub security advisories and apply all relevant security updates as soon as they are made available by the vendor.

Proactive Monitoring: Review access logs for unusual account activity or unauthorized repository modifications that may indicate an attempt to leverage this vulnerability.

Compensating Controls: Ensure that multi-factor authentication is enforced across all GitHub accounts and limit administrative privileges to the minimum necessary level to reduce the potential attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of specific technical details regarding the entry point necessitates a proactive posture until the vendor provides further guidance.

Analyst Recommendation

Given the lack of granular technical data, administrators should prioritize the continuous monitoring of GitHub security bulletins. The severity level suggests that once a patch is released, it should be deployed with high urgency to prevent potential unauthorized access to critical development infrastructure.

---METADATA---
VENDOR: Flowise
PRODUCT: Flowise
AFFECTED_VERSIONS: Prior to 3.1.2
---END_METADATA---

Description Summary:
Flowise versions prior to 3.1.2 lack authentication middleware on CRUD endpoints for OpenAI Assistants Vector Store, enabling unauthorized data modification.

Executive Summary:
A high-severity authentication bypass vulnerability in Flowise allows unauthenticated attackers to modify or delete sensitive data within OpenAI Assistants Vector Stores.

Vulnerability Details

CVE-ID: CVE-2026-46444

Affected Software: Flowise

Affected Versions: Prior to 3.1.2

Vulnerability: All CRUD endpoints related to the OpenAI Assistants Vector Store lack necessary authentication middleware. This allows an unauthenticated remote attacker to perform unauthorized operations, including the modification or deletion of data managed within the Flowise interface.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to the integrity and availability of AI-driven workflows. An attacker could destroy valuable training data or inject malicious information into vector stores, leading to corrupted model behavior and potential loss of intellectual property.

Remediation Plan

Immediate Action: Upgrade Flowise to version 3.1.2 or later to implement the required authentication middleware.

Proactive Monitoring: Review access logs for the Flowise administrative interface and monitor for unauthorized API requests targeting the Vector Store endpoints.

Compensating Controls: Implement network-level access controls to restrict access to the Flowise management interface to authorized internal IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The absence of authentication on critical API endpoints makes this an urgent security priority. All users of Flowise must upgrade to version 3.1.2 immediately to secure the platform against unauthorized data manipulation. Restricting network access to the application is a recommended secondary measure until the update is fully deployed.

---METADATA---
VENDOR: oscal-compass
PRODUCT: compliance-trestle
AFFECTED_VERSIONS: < 3.12.2, >= 4.0.0, < 4.0.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Compliance-trestle is vulnerable to code injection and improper template engine neutralization, allowing potential arbitrary code execution.

Executive Summary:
A code injection vulnerability in the compliance-trestle platform poses a high risk of total system compromise if exploited.

Vulnerability Details

CVE-ID: CVE-2026-46439

Affected Software: oscal-compass compliance-trestle

Affected Versions: < 3.12.2, >= 4.0.0, < 4.0.3

Vulnerability: This vulnerability involves improper control of code generation and template engine neutralization (CWE-94 and CWE-1336). It allows an attacker to inject and execute arbitrary code, requiring local access and user interaction to trigger.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the application process. Given the CVSS score of 7.8, this poses a significant threat to the confidentiality, integrity, and availability of sensitive compliance data managed by the platform.

Remediation Plan

Immediate Action: Update compliance-trestle to version 3.12.2 or 4.0.3 immediately to incorporate the provided security fixes.

Proactive Monitoring: Monitor system logs for suspicious execution patterns or unauthorized file modifications originating from the compliance-trestle process.

Compensating Controls: Ensure the application runs with the principle of least privilege to minimize the impact of potential code execution.

Exploitation Status

Public Exploit Available: No (no confirmed weaponized exploit or public PoC identified).

Analyst Notes: As of August 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw stems from how the tool processes templates, which can be manipulated to achieve code execution.

Analyst Recommendation

The severity of this vulnerability necessitates immediate patching. Administrators should prioritize upgrading to the specified safe versions to neutralize the risk of arbitrary code execution and protect the integrity of the compliance environment.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: Prior to 3.38.2
---END_METADATA---

Description Summary:
Budibase contains an authorization bypass vulnerability in the SCIM API, allowing authenticated users to perform unauthorized CRUD operations on all users and groups.

Executive Summary:
An authorization flaw in the Budibase SCIM API allows authenticated users to gain unauthorized administrative control over tenant user and group data.

Vulnerability Details

CVE-ID: CVE-2026-46425

Affected Software: Budibase Budibase

Affected Versions: Prior to 3.38.2

Vulnerability: The SCIM router fails to implement role-based access control, allowing any authenticated user—regardless of their assigned role—to interact with sensitive administrative SCIM endpoints.

Business Impact

Successful exploitation allows an attacker to manipulate the entire user directory, including the creation, modification, or deletion of administrative accounts. Given the CVSS score of 9.9, this poses a critical risk of full tenant compromise and unauthorized data manipulation, potentially leading to a complete loss of platform integrity.

Remediation Plan

Immediate Action: Upgrade all Budibase instances to version 3.38.2 or later to enforce mandatory role checks on SCIM endpoints.

Proactive Monitoring: Review application access logs for unusual patterns of SCIM API requests or unauthorized modifications to user and group structures.

Compensating Controls: If immediate patching is not feasible, restrict network access to the SCIM API endpoints via firewall rules to known trusted administrative IP addresses.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical breakdown in access control. Administrators must prioritize updating to version 3.38.2 immediately to prevent unauthorized administrative escalation within the environment.

---METADATA---
VENDOR: RocketChat
PRODUCT: Rocket.Chat
AFFECTED_VERSIONS: 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11
---END_METADATA---

Description Summary:
Rocket.Chat's SAML implementation fails to validate signatures when no IdP certificate is configured, allowing unauthenticated attackers to bypass authentication.

Executive Summary:
A critical authentication bypass in Rocket.Chat allows unauthenticated attackers to gain unauthorized access due to a failure in SAML signature validation.

Vulnerability Details

CVE-ID: CVE-2026-46423

Affected Software: RocketChat Rocket.Chat

Affected Versions: Versions prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11

Vulnerability: The SAML service provider implementation contains a fail-open design where signature validation is skipped if the IdP certificate is missing. Because this is the default state, an unauthenticated attacker can submit forged SAML assertions to gain unauthorized access.

Business Impact

With a CVSS score of 9.3, this flaw represents a complete breakdown of the authentication mechanism. Successful exploitation grants attackers full access to the Rocket.Chat platform, potentially exposing all internal communications, user data, and sensitive workspace information, leading to a catastrophic data breach.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates (8.5.0, 8.4.1, 8.3.3, etc.) immediately to enforce mandatory SAML signature validation.

Proactive Monitoring: Audit SAML configuration settings to ensure a valid IdP certificate is properly defined and monitor login logs for suspicious authentication patterns.

Compensating Controls: Temporarily disable SAML authentication if an immediate update cannot be performed, reverting to local authentication or other secure methods.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is an authentication-bypass class vulnerability that requires immediate attention. Organizations utilizing SAML for Rocket.Chat must treat this as a high-priority incident and apply the relevant patches to ensure the integrity of their authentication processes.

---METADATA---
VENDOR: Google
PRODUCT: Angular
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Angular contains a security vulnerability that may allow for unauthorized operations within web applications developed on the platform.

Executive Summary:
A High-severity security vulnerability in the Angular development platform poses a significant risk to the security posture of applications built using the framework.

Vulnerability Details

CVE-ID: CVE-2026-46417

Affected Software: Google Angular

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Angular framework, potentially exposing applications to security risks during the processing of client-side operations. The flaw requires further investigation into the specific injection or bypass vector to determine if user authentication is required for successful exploitation.

Business Impact

A CVSS score of 8.8 indicates a high potential for impact on application security, including cross-site scripting (XSS) or unauthorized data access. If exploited, this could lead to the theft of user sessions, sensitive data leakage, or the compromise of the end-user experience, causing significant reputational damage.

Remediation Plan

Immediate Action: Update all instances of the Angular framework to the latest stable version provided by the vendor immediately.

Proactive Monitoring: Review application access logs and monitor for unusual traffic patterns that deviate from standard user behavior.

Compensating Controls: Implement strict Content Security Policy (CSP) headers to mitigate potential client-side execution risks while the update process is underway.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because Angular serves as the foundation for modern web applications, the impact of this vulnerability is widespread. It is critical that development teams verify their current version and apply security updates as soon as they are made available to protect the integrity of their web applications.

---METADATA---
VENDOR: JasonLovesDoggo
PRODUCT: caddy-defender
AFFECTED_VERSIONS: < 0.10.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Caddy Defender plugin for Caddy contains an access control vulnerability that allows attackers to bypass IP-based security restrictions.

Executive Summary:
An improper access control vulnerability in the Caddy Defender plugin allows remote, unauthenticated attackers to bypass security restrictions and potentially expose sensitive information.

Vulnerability Details

CVE-ID: CVE-2026-46415

Affected Software: JasonLovesDoggo caddy-defender

Affected Versions: < 0.10.1

Vulnerability: This vulnerability stems from improper access control (CWE-284) and the use of less trusted sources (CWE-348). It allows an unauthenticated attacker to manipulate or bypass intended IP-based request filtering, potentially gaining unauthorized access to protected resources.

Business Impact

Successful exploitation could result in the bypass of critical security boundaries, leading to unauthorized access to web services and data exposure. Given the CVSS score of 8.2, the impact on business operations is high, as it invalidates the security logic intended to protect backend services from malicious or unauthorized traffic.

Remediation Plan

Immediate Action: Update the caddy-defender middleware to version 0.10.1 or later to resolve the access control logic errors.

Proactive Monitoring: Audit Caddy access logs to identify requests originating from unauthorized IP addresses that were successfully processed by the middleware.

Compensating Controls: Implement additional layer seven security controls, such as a robust Web Application Firewall, to enforce access policies independently of the middleware.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw relies on the misinterpretation of client source data, which is a common vector in web security.

Analyst Recommendation

Given the ease with which this vulnerability can be exploited by an unauthenticated attacker, immediate remediation is required. Administrators should verify their Caddy configuration after updating to ensure that access control rules are functioning as expected.

---METADATA---
VENDOR: Microsoft
PRODUCT: UFO
AFFECTED_VERSIONS: 3.0.1-4-ge2626659
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Microsoft UFO framework is susceptible to multiple bypass vulnerabilities, including authentication and authorization flaws, allowing authenticated attackers to perform unauthorized actions.

Executive Summary:
An authentication and authorization bypass vulnerability in the Microsoft UFO framework poses a significant risk of unauthorized access and system manipulation.

Vulnerability Details

CVE-ID: CVE-2026-46414

Affected Software: Microsoft UFO

Affected Versions: 3.0.1-4-ge2626659

Vulnerability: This issue is characterized by CWE-290, CWE-639, and CWE-862, indicating a failure to properly authenticate or authorize users. An attacker with low-level credentials can bypass security controls to potentially perform actions reserved for higher-privileged users.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant risk to the integrity and confidentiality of automated workflows. Successful exploitation could allow attackers to spoof identities or access sensitive data, potentially leading to unauthorized automation of critical tasks and system-wide compromise.

Remediation Plan

Immediate Action: Monitor the official Microsoft UFO repository for security patches and apply updates as soon as they become available.

Proactive Monitoring: Audit logs for unauthorized access patterns or unexpected privilege escalation events within the UFO framework.

Compensating Controls: Implement strict network segmentation and restrict access to the UFO interface to trusted internal networks only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of June 2, 2026, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. There is no confirmed active exploitation in the wild, but the existence of a PoC necessitates heightened vigilance.

Analyst Recommendation

The presence of a proof-of-concept increases the urgency of this advisory. Organizations should monitor for official vendor guidance and deploy the security patch immediately upon release to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: BeProduct
PRODUCT: beproduct-org-nestjs-auth
AFFECTED_VERSIONS: >= 0.1.2, <= 0.1.19
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The @beproduct/nestjs-auth package was compromised via a malicious npm publish, leading to the distribution of versions containing code designed to exfiltrate environment secrets and credentials.

Executive Summary:
A supply chain compromise of the beproduct-org-nestjs-auth module has resulted in the distribution of malicious code capable of harvesting sensitive credentials and environment variables.

Vulnerability Details

CVE-ID: CVE-2026-46412

Affected Software: BeProduct beproduct-org-nestjs-auth

Affected Versions: >= 0.1.2, <= 0.1.19

Vulnerability: This is an embedded malicious code vulnerability (CWE-506) where unauthorized actors injected a payload into the package that exfiltrates npm tokens, GitHub PATs, AWS credentials, and HashiCorp Vault secrets. The attack requires no authentication as it executes automatically upon installation.

Business Impact

The impact of this vulnerability is critical, as it facilitates a complete compromise of the development and deployment environments. Successful exploitation allows attackers to steal long-lived credentials, potentially leading to unauthorized access to cloud infrastructure, source code repositories, and production systems. Given the CVSS score of 10.0, this represents a total loss of confidentiality, integrity, and availability for the affected host.

Remediation Plan

Immediate Action: Remove the compromised package, clear the npm cache, and install version 0.1.20 or later. Crucially, rotate all credentials that were present in the environment at the time of installation, including AWS keys, GitHub tokens, and npm publish tokens.

Proactive Monitoring: Audit CI/CD pipelines and developer workstations for indicators of compromise, specifically checking for unexpected files in .claude/ or .vscode/ directories.

Compensating Controls: Implement supply chain security tools that perform dependency scanning and verify package integrity before installation.

Exploitation Status

Public Exploit Available: No (Exploit available: false)

Analyst Notes: As of July 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The malicious code was part of a supply chain injection incident, and the primary risk stems from the credentials already harvested during installation.

Analyst Recommendation

Users of the affected package must treat all systems where these versions were installed as potentially compromised. Immediate rotation of every secret present in the environment is mandatory, followed by a thorough forensic audit of the affected hosts to ensure no persistence mechanisms were established by the malicious payload.

---METADATA---
VENDOR: gtsteffaniak
PRODUCT: filebrowser
AFFECTED_VERSIONS: < 1.3.2-stable, < 1.4.1-beta
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An information exposure vulnerability in FileBrowser Quantum allows unauthenticated remote attackers to access sensitive information due to improper security controls.

Executive Summary:
A critical information exposure vulnerability in FileBrowser Quantum allows unauthenticated attackers to remotely access sensitive system information, posing a significant risk to data privacy.

Vulnerability Details

CVE-ID: CVE-2026-46410

Affected Software: gtsteffaniak filebrowser

Affected Versions: < 1.3.2-stable, < 1.4.1-beta

Vulnerability: The vulnerability is categorized as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). It allows an unauthenticated, remote attacker to bypass intended access controls and retrieve sensitive data from the file manager.

Business Impact

With a CVSS score of 8.7, this flaw poses a severe risk to the confidentiality of stored data. Unauthorized access to a file manager can lead to the exposure of proprietary business documents, configuration files, or credentials, resulting in significant data breaches and potential regulatory non-compliance.

Remediation Plan

Immediate Action: Update the FileBrowser installation to the latest stable release (1.3.2-stable or higher) or the corresponding patched beta version to remediate the exposure.

Proactive Monitoring: Review access logs for unusual patterns of directory listing or file retrieval requests originating from unknown or unauthorized IP addresses.

Compensating Controls: Ensure the application is behind a robust authentication proxy or VPN, and restrict network access to the file manager interface to trusted internal segments only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly concerning due to the lack of required authentication for exploitation.

Analyst Recommendation

The ability for an unauthenticated user to access sensitive files makes this a high-priority remediation task. Organizations should apply the vendor-provided patches immediately to secure their file management infrastructure.

---METADATA---
VENDOR: givanz
PRODUCT: Vvveb
AFFECTED_VERSIONS: < 1.0.8.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Vvveb CMS is susceptible to an authorization bypass vulnerability allowing authenticated users to manipulate resources via user-controlled keys.

Executive Summary:
An authorization bypass vulnerability in Vvveb CMS could allow authenticated users to perform unauthorized actions, potentially compromising data integrity.

Vulnerability Details

CVE-ID: CVE-2026-46408

Affected Software: givanz Vvveb

Affected Versions: < 1.0.8.3

Vulnerability: This vulnerability, categorized as CWE-639, stems from improper authorization checks, allowing a user with low privileges to access or manipulate data by modifying user-controlled keys.

Business Impact

Successful exploitation allows an attacker to bypass intended access controls, leading to unauthorized data modification or administrative actions within the CMS. While the CVSS score of 7.6 reflects a high severity due to the potential for significant impact on data integrity, the requirement for initial authentication limits the immediate attack surface.

Remediation Plan

Immediate Action: Update the Vvveb CMS installation to version 1.0.8.3 or later immediately.

Proactive Monitoring: Review application access logs for unusual patterns of resource access or unauthorized modification attempts by low-privileged accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block suspicious parameter tampering or unexpected API requests.

Exploitation Status

Public Exploit Available: No (Exploit_available: false)

Analyst Notes: As of May 17, 2026, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw's inherent exploitability is moderate due to the requirement for an authenticated session.

Analyst Recommendation

The vulnerability poses a significant risk to the integrity of the Vvveb CMS environment. Administrators should prioritize applying the vendor-provided security update to version 1.0.8.3 to eliminate the underlying authorization flaw and prevent potential unauthorized data manipulation.

---METADATA---
VENDOR: givanz
PRODUCT: Vvveb
AFFECTED_VERSIONS: givanz Vvveb: < 1.0.8.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authorization bypass vulnerability in the Vvveb CMS allows attackers to manipulate user-controlled keys to access unauthorized functionality.

Executive Summary:
An authorization bypass vulnerability in Vvveb CMS could allow authenticated attackers to gain unauthorized access to restricted features or data.

Vulnerability Details

CVE-ID: CVE-2026-46407

Affected Software: givanz Vvveb

Affected Versions: givanz Vvveb < 1.0.8.3

Vulnerability: This is an authorization bypass (CWE-639) where the application fails to properly validate user-controlled keys. The vulnerability requires the attacker to have low-level privileges (PR:L) to initiate the request.

Business Impact

With a CVSS score of 8.1 (High), this vulnerability poses a significant risk to the integrity and confidentiality of the CMS. An attacker could exploit this to perform administrative actions, modify website content, or access sensitive business data, leading to potential operational disruption or data breaches.

Remediation Plan

Immediate Action: Update the Vvveb CMS installation to version 1.0.8.3 or later immediately.

Proactive Monitoring: Review audit logs for unusual access patterns or unauthorized attempts to perform administrative functions by low-privileged user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests targeting CMS parameter manipulation.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the predictable nature of the authorization flaw.

Analyst Recommendation

The presence of a proof-of-concept elevates the urgency of this patch. Administrators should prioritize upgrading their Vvveb instances to the latest version to prevent potential unauthorized access and maintain system security.

---METADATA---
VENDOR: Galaxy Software Services
PRODUCT: Vitals ESP
AFFECTED_VERSIONS: 0 through 6.3
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.twcert.org.tw/tw/cp-132-10794-704a2-1.html","name":null,"tags":["third-party-advisory"]},{"url":"https://www.twcert.org.tw/en/cp-139-10795-25784-2.html","name":null,"tags":["third-party-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:42.575Z
---END_METADATA---

Description Summary:
Vitals ESP contains a missing authentication vulnerability that allows unauthenticated remote attackers to execute functions and access sensitive information.

Executive Summary:
An unauthenticated remote code execution vulnerability in Galaxy Software Services Vitals ESP poses a significant risk of unauthorized information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-4640

Affected Software: Galaxy Software Services Vitals ESP

Affected Versions: 0 through 6.3

Vulnerability: The application fails to perform proper authentication checks for critical functions, allowing an unauthenticated remote attacker to interact with the system and retrieve sensitive data.

Business Impact

The vulnerability carries a CVSS score of 7.5, indicating a high severity level. Successful exploitation allows unauthorized parties to bypass security controls and access sensitive information, which could lead to data breaches, loss of intellectual property, and significant regulatory non-compliance.

Remediation Plan

Immediate Action: Contact Galaxy Software Services support immediately to obtain the necessary security patch or configuration update for Vitals ESP.

Proactive Monitoring: Review system and application access logs for unauthorized requests, particularly those originating from unknown or suspicious IP addresses targeting internal functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access attempts to administrative or sensitive endpoints until the software is patched.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its lack of authentication requirements, which makes it highly automatable.

Analyst Recommendation

Given the high CVSS score and the ability for unauthenticated attackers to retrieve sensitive information, this vulnerability should be prioritized for immediate remediation. Organizations should contact the vendor directly to secure the patch and verify their current deployment versions against the affected range to assess their exposure.

---METADATA---
VENDOR: Galaxy Software Services
PRODUCT: Vitals ESP
AFFECTED_VERSIONS: 0 through 6.3
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.twcert.org.tw/tw/cp-132-10794-704a2-1.html","name":null,"tags":["third-party-advisory"]},{"url":"https://www.twcert.org.tw/en/cp-139-10795-25784-2.html","name":null,"tags":["third-party-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:42.555Z
---END_METADATA---

Description Summary:
Vitals ESP contains an authorization flaw that allows authenticated remote attackers to perform unauthorized administrative functions and escalate privileges.

Executive Summary:
A critical authorization vulnerability in Vitals ESP allows authenticated attackers to perform unauthorized administrative actions, leading to potential privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-4639

Affected Software: Galaxy Software Services Vitals ESP

Affected Versions: 0 through 6.3

Vulnerability: The application fails to properly enforce authorization checks (CWE-863), allowing any authenticated user to execute administrative functions. This vulnerability is accessible to remote attackers who have already established a valid session.

Business Impact

The ability for a standard user to escalate privileges to an administrative level poses a significant risk to the integrity and confidentiality of the Vitals ESP environment. Successful exploitation could lead to full system compromise, unauthorized data modification, and the potential for lateral movement within the network. With a CVSS score of 8.8, this vulnerability is categorized as high severity and requires immediate attention to prevent unauthorized administrative control.

Remediation Plan

Immediate Action: Contact Galaxy Software Services support immediately to obtain and apply the necessary security patches for Vitals ESP.

Proactive Monitoring: Review system and application access logs for unusual administrative activity or changes to user permission levels that deviate from established baselines.

Compensating Controls: Implement strict access control lists and, where applicable, utilize a Web Application Firewall to monitor and restrict access to administrative endpoints.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of March 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires an authenticated session, the technical impact is total, making the mitigation of this flaw a priority for all organizations running version 6.3 or earlier.

Analyst Recommendation

Given the high CVSS score and the potential for full administrative privilege escalation, organizations must treat this vulnerability with high urgency. Administrators should verify their current version of Vitals ESP and coordinate with the vendor to secure the environment against potential exploitation. Patching remains the most effective way to eliminate this risk.

---METADATA---
VENDOR: Kubernetes
PRODUCT: UDS Identity Config
AFFECTED_VERSIONS: 0.11.0 through 0.26.0
---END_METADATA---

Description Summary:
A logic error in the Kubernetes UDS Identity Config component allows attackers to bypass client secret authentication and obtain unauthorized OAuth2 tokens.

Executive Summary:
A critical authentication bypass in Kubernetes UDS Identity Config allows attackers to impersonate clients and gain unauthorized access to service accounts.

Vulnerability Details

CVE-ID: CVE-2026-46389

Affected Software: Kubernetes UDS Identity Config

Affected Versions: 0.11.0 through 0.26.0

Vulnerability: A logic error in the client-kubernetes-secret Keycloak client authenticator causes the user-submitted client_secret to be overwritten by the mounted Kubernetes secret before comparison. This allows an attacker who knows a client_id to authenticate with an arbitrary secret and obtain tokens scoped to that client's service account.

Business Impact

With a CVSS score of 10.0, this vulnerability represents the highest level of risk. An attacker can gain broad administrative or service-level access, such as the ability to modify other clients via the uds-operator token, potentially leading to a full compromise of the identity management system and associated services.

Remediation Plan

Immediate Action: Update UDS Identity Config to version 0.26.1 or later.

Proactive Monitoring: Monitor Keycloak authentication logs for unusual token request patterns or authentication attempts using unexpected client secrets.

Compensating Controls: Restrict access to the Keycloak token endpoint at the network or ingress controller level to limit the exposure of the identity service.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, the critical nature of the flaw and the potential for total identity compromise make it an extremely high-risk target.

Analyst Recommendation

Immediate remediation is required due to the CVSS 10.0 rating and the potential for complete identity provider compromise. Organizations must upgrade to version 0.26.1 and review all recent authentication activity for signs of unauthorized token generation.

---METADATA---
VENDOR: OpenProject
PRODUCT: OpenProject
AFFECTED_VERSIONS: All versions prior to the patch
---END_METADATA---

Description Summary:
A default, insecure secret key configuration in the official OpenProject Docker image allows authenticated users to achieve remote code execution via Marshal-deserialization of cookies.

Executive Summary:
A critical security misconfiguration in the official OpenProject Docker image exposes users to remote code execution due to the use of a predictable, default Rails master key.

Vulnerability Details

CVE-ID: CVE-2026-46386

Affected Software: OpenProject

Affected Versions: All versions using the vulnerable default Docker image configuration

Vulnerability: The official Docker image ships with a default Rails secret key (SECRET_KEY_BASE=OVERWRITE_ME), which allows authenticated users to forge cookies. Because the application uses :marshal for cookie serialization, this allows an attacker to trigger arbitrary code execution during the deserialization process.

Business Impact

This vulnerability carries a CVSS score of 9.9, reflecting the extreme risk of total system compromise. By leveraging this flaw, an authenticated user can execute arbitrary code on the server hosting the OpenProject application. This grants the attacker full control over the project management environment, facilitating lateral movement, data theft, or complete system takeover.

Remediation Plan

Immediate Action: Update to the latest version of OpenProject and ensure the SECRET_KEY_BASE environment variable is changed to a strong, unique, and securely generated secret.

Proactive Monitoring: Monitor server logs for signs of anomalous process execution or unexpected system-level changes originating from the OpenProject container.

Compensating Controls: Restrict access to the OpenProject instance to trusted networks only and ensure that the application is running with the least privilege necessary within the container environment.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, the presence of a hardcoded, publicly known default secret key makes this an attractive target for attackers, and the risk of exploitation remains critical.

Analyst Recommendation

The reliance on a default, predictable secret key in a production-ready Docker image is a significant security failure. Administrators must immediately rotate their secret keys and update their deployment configurations to ensure the environment is secured against this deserialization attack vector.

---METADATA---
VENDOR: Meeting Room Booking System
PRODUCT: mrbs-code
AFFECTED_VERSIONS: < 1.12.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in the Meeting Room Booking System (MRBS) allows unauthenticated attackers to send unauthorized requests to internal or external resources.

Executive Summary:
An unauthenticated Server-Side Request Forgery vulnerability in the Meeting Room Booking System allows attackers to abuse the application to probe internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-46382

Affected Software: Meeting Room Booking System (MRBS)

Affected Versions: Versions prior to 1.12.2

Vulnerability: This is an SSRF vulnerability (CWE-918) which allows an attacker to force the server to make requests to unintended locations. Notably, this vulnerability is exploitable by an unauthenticated attacker (PR:N).

Business Impact

By leveraging the server as a proxy, an attacker can bypass firewalls to scan internal network segments, access sensitive internal APIs, or interact with cloud metadata services. With a CVSS score of 8.7, this vulnerability represents a severe threat to network segmentation and internal defense-in-depth strategies, potentially leading to further lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade to MRBS version 1.12.2 or higher to resolve the SSRF vulnerability.

Proactive Monitoring: Monitor server egress traffic for unusual outbound connections, especially those directed toward internal IP addresses or sensitive cloud infrastructure endpoints.

Compensating Controls: Restrict the application server's network access to only necessary external resources via firewall egress rules to prevent unauthorized scanning of the internal network.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this vulnerability particularly dangerous, as it can be exploited remotely without prior system access.

Analyst Recommendation

The ability for an unauthenticated attacker to perform SSRF is a critical security failure. Organizations deploying the Meeting Room Booking System should prioritize patching this software immediately to close the potential vector for internal network reconnaissance and lateral movement.

---METADATA---
VENDOR: OpenWrt
PRODUCT: luci-app-https-dns-proxy
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The luci-app-https-dns-proxy package for OpenWrt contains an unspecified vulnerability.

Executive Summary:
A high-severity vulnerability has been identified in the luci-app-https-dns-proxy package for OpenWrt, which requires immediate attention from network administrators.

Vulnerability Details

CVE-ID: CVE-2026-46368

Affected Software: OpenWrt luci-app-https-dns-proxy

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The specific nature of this vulnerability in the DNS proxy application is currently under investigation, but it has been rated with a high CVSS score, suggesting a significant risk to network security.

Business Impact

With a CVSS score of 8.8, this vulnerability could potentially allow attackers to intercept or manipulate DNS traffic, leading to man-in-the-middle attacks or redirection of network users to malicious sites, which is critical for infrastructure security.

Remediation Plan

Immediate Action: Check for OpenWrt package updates and apply the latest version of the luci-app-https-dns-proxy package.

Proactive Monitoring: Monitor DNS query logs for signs of redirection or unauthorized traffic patterns.

Compensating Controls: If a patch is unavailable, consider temporarily disabling the proxy service or implementing alternative DNS security measures (e.g., DNSSEC).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Network administrators should treat this vulnerability with urgency. Given the potential impact on network traffic integrity, ensure that all OpenWrt packages are updated to the latest secure versions as soon as they become available.

---METADATA---
VENDOR: thorsten
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: thorsten phpmyfaq: 4.1.1 up to (excluding) 4.1.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability exists in phpMyFAQ, allowing attackers to inject malicious scripts into the application via the comment rendering utility.

Executive Summary:
A stored cross-site scripting vulnerability in phpMyFAQ allows authenticated attackers to execute arbitrary scripts in the context of other users' sessions.

Vulnerability Details

CVE-ID: CVE-2026-46367

Affected Software: thorsten phpMyFAQ

Affected Versions: thorsten phpmyfaq: 4.1.1 up to (excluding) 4.1.2

Vulnerability: This is a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) occurring within the comment rendering component. The attack requires the user to have low privileges (PR:L) and involves the interaction of a victim (UI:P).

Business Impact

The CVSS score of 7.6 (High) highlights the risk of session hijacking and unauthorized data access. By injecting malicious scripts, an attacker could steal session cookies, perform actions on behalf of administrative users, or redirect users to malicious external sites, damaging both user trust and organizational reputation.

Remediation Plan

Immediate Action: Update phpMyFAQ to version 4.1.2 or later, where the input sanitization for comment rendering has been corrected.

Proactive Monitoring: Inspect web application logs for suspicious characters or script tags within user-submitted comments or content fields.

Compensating Controls: Implement a robust Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize WAF rules to detect and block common XSS payloads.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous as it allows for persistent malicious code execution within the application.

Analyst Recommendation

Given the potential for account takeover through XSS, immediate application of the patch is necessary. Organizations should ensure that all instances of phpMyFAQ are updated to the secure version 4.1.2 to eliminate the XSS vector.

---METADATA---
VENDOR: thorsten
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: 0 up to (excluding) 4.1.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
phpMyFAQ is susceptible to an unauthenticated information disclosure vulnerability due to incorrect authorization checks in the application.

Executive Summary:
A critical authorization bypass vulnerability in phpMyFAQ allows unauthenticated attackers to potentially access sensitive information.

Vulnerability Details

CVE-ID: CVE-2026-46366

Affected Software: thorsten phpMyFAQ

Affected Versions: 0 up to (excluding) 4.1.2

Vulnerability: This vulnerability (CWE-863) allows unauthenticated remote attackers to bypass permission checks, specifically affecting the getIdFromSolutionId function, leading to unauthorized information disclosure.

Business Impact

The ability for unauthenticated users to extract sensitive data presents a severe risk to confidentiality. With a CVSS score of 7.5, this vulnerability is highly dangerous as it requires no user interaction or prior credentials, potentially leading to widespread data exposure if not addressed immediately.

Remediation Plan

Immediate Action: Upgrade phpMyFAQ to version 4.1.2 or later to remediate the authorization check bypass.

Proactive Monitoring: Monitor database query logs and web server traffic for unusual access patterns targeting FAQ solution IDs or administrative endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter out suspicious requests targeting internal application functions until the software can be patched.

Exploitation Status

Public Exploit Available: No (Exploit_available: false)

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly automatable, which significantly elevates the risk of widespread exploitation.

Analyst Recommendation

Given the unauthenticated nature of this vulnerability and its potential for mass data disclosure, organizations must treat this as a high-priority incident. Immediate patching to version 4.1.2 is strongly recommended to protect sensitive knowledge base content.

---METADATA---
VENDOR: phpMyFAQ
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: Prior to 4.1.2
---END_METADATA---

Description Summary:
phpMyFAQ contains an unauthenticated SQL injection vulnerability in its captcha handling methods, allowing attackers to extract sensitive database information.

Executive Summary:
An unauthenticated SQL injection vulnerability in phpMyFAQ allows attackers to extract sensitive data, including administrative tokens and credentials, from the backend database.

Vulnerability Details

CVE-ID: CVE-2026-46364

Affected Software: phpMyFAQ

Affected Versions: Prior to 4.1.2

Vulnerability: The application fails to sanitize User-Agent headers before incorporating them into database queries, allowing unauthenticated attackers to perform time-based blind SQL injection.

Business Impact

The exposure of administrative credentials and tokens enables full application takeover and sensitive data breach. A CVSS score of 9.8 highlights the critical danger of this unauthenticated data access.

Remediation Plan

Immediate Action: Update phpMyFAQ to version 4.1.2 or later to patch the vulnerable captcha methods.

Proactive Monitoring: Monitor database query logs for time-intensive queries or patterns associated with SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious User-Agent headers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability provides a direct pathway to database compromise. Immediate patching is required to prevent unauthorized access to sensitive application data.

---METADATA---
VENDOR: Keycloak
PRODUCT: Keycloak
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in Keycloak, an open-source identity and access management solution, which could compromise authentication integrity.

Executive Summary:
Keycloak is affected by a critical flaw that could allow attackers to undermine identity management and gain unauthorized access to protected applications.

Vulnerability Details

CVE-ID: CVE-2026-4636

Affected Software: Keycloak

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability exists within the Keycloak core identity management framework. While specific technical details are limited, flaws in such systems typically involve authentication bypasses, improper token validation, or privilege escalation vulnerabilities that can be exploited by an attacker.

Business Impact

Keycloak is a central component for authentication across many enterprises; therefore, a compromise here could grant an attacker access to any application integrated with the service. The CVSS score of 8.1 reflects the high risk of unauthorized data access and the potential for widespread lateral movement within an organization's infrastructure.

Remediation Plan

Immediate Action: Apply the latest security patches from the Keycloak project immediately to secure the identity provider.

Proactive Monitoring: Review Keycloak audit logs for unusual login patterns, unauthorized client registrations, or unexpected changes to realm roles and permissions.

Compensating Controls: Enable Multi-Factor Authentication (MFA) for all users and restrict access to the Keycloak admin console to internal, trusted networks only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation. However, identity providers are high-value targets for attackers, and the potential for exploitation is considered high.

Analyst Recommendation

Organizations relying on Keycloak for identity and access management must treat this vulnerability with the highest urgency. Applying the vendor's security updates is the only effective way to mitigate the risk to the entire authentication chain.

---METADATA---
VENDOR: thorsten
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: 0 up to (excluding) 4.1.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
phpMyFAQ is susceptible to a SQL injection vulnerability via unescaped OAuth token fields, potentially allowing for arbitrary command execution.

Executive Summary:
An SQL injection vulnerability in phpMyFAQ allows remote attackers to compromise the underlying database, leading to potential total system impact.

Vulnerability Details

CVE-ID: CVE-2026-46359

Affected Software: thorsten phpMyFAQ

Affected Versions: 0 up to (excluding) 4.1.2

Vulnerability: This vulnerability (CWE-89) occurs due to improper neutralization of special elements in SQL commands within the currentUser->setTokenData function when processing unescaped OAuth token fields.

Business Impact

This SQL injection vulnerability permits an attacker to manipulate database queries, potentially leading to unauthorized data access, modification, or total system compromise. The CVSS score of 7.5 underscores the critical nature of this flaw, as it allows for high technical impact on the confidentiality, integrity, and availability of the application.

Remediation Plan

Immediate Action: Upgrade to phpMyFAQ version 4.1.2 or later to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Inspect database logs for abnormal SQL syntax or unexpected query structures that suggest injection attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) configured with SQL injection protection rules to block malicious payloads targeting OAuth token fields.

Exploitation Status

Public Exploit Available: No (Exploit_available: false)

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. While exploitation requires specific conditions, the potential for total technical impact makes this a high-risk vulnerability.

Analyst Recommendation

SQL injection is a severe security flaw that can lead to complete database compromise. Security teams must ensure all instances of phpMyFAQ are updated to version 4.1.2 immediately to neutralize this threat and prevent potential data breaches.

---METADATA---
VENDOR: Coder
PRODUCT: Coder
AFFECTED_VERSIONS: 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 (fixed versions)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coder contains an improper cryptographic signature verification flaw in azureidentity.Validate(), allowing attackers to forge session tokens via manipulated Azure VM identities.

Executive Summary:
A critical cryptographic vulnerability in Coder allows attackers to forge workspace session tokens, leading to unauthorized access to remote development environments.

Vulnerability Details

CVE-ID: CVE-2026-46354

Affected Software: Coder

Affected Versions: < 2.24.5, 2.29.0 < 2.29.13, 2.30.0 < 2.30.8, 2.31.0 < 2.31.12, 2.32.0-rc.0 < 2.32.2, 2.33.0-rc.0 < 2.33.3

Vulnerability: The application fails to verify the PKCS#7 signature during Azure identity validation. An unauthenticated attacker can supply a forged VM ID to obtain a valid session token for a target workspace.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe threat to the integrity of development environments. An attacker could gain unauthorized access to source code, secrets, and infrastructure tokens stored within developer workspaces, potentially leading to supply chain compromises and intellectual property theft.

Remediation Plan

Immediate Action: Upgrade the Coder platform to the patched versions: 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, or 2.33.3.

Proactive Monitoring: Audit session logs for unusual workspace access patterns or tokens originating from unrecognized VM IDs.

Compensating Controls: Reconfigure Azure templates to utilize token-based authentication rather than azure-instance-identity until the patch is successfully applied.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to the security of development pipelines. Administrators must verify their current Coder version and apply the recommended patches immediately to prevent session token forgery and unauthorized workspace access.

---METADATA---
VENDOR: bigbluebutton
PRODUCT: bigbluebutton
AFFECTED_VERSIONS: < 3.0.21
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
BigBlueButton is affected by an improper access control vulnerability, which may allow an authenticated user to perform unauthorized actions within the virtual classroom.

Executive Summary:
An improper access control vulnerability in BigBlueButton versions prior to 3.0.21 permits authenticated users to perform unauthorized actions, threatening platform integrity.

Vulnerability Details

CVE-ID: CVE-2026-46353

Affected Software: bigbluebutton bigbluebutton

Affected Versions: < 3.0.21

Vulnerability: This is an improper access control vulnerability (CWE-284) that allows an authenticated user to bypass intended restrictions. The vulnerability is accessible via the network and requires the attacker to have already established an authenticated session.

Business Impact

Unauthorized access control can result in the exposure or manipulation of sensitive classroom data and administrative settings. Given the CVSS score of 8.1, successful exploitation could lead to significant disruption of virtual learning environments and potential privacy breaches.

Remediation Plan

Immediate Action: Apply the vendor-provided update to version 3.0.21 immediately.

Proactive Monitoring: Audit user activity logs to identify any accounts performing actions outside of their assigned roles or permissions.

Compensating Controls: Implement strict role-based access control (RBAC) policies and ensure that all user permissions are reviewed and restricted to the minimum required for their function.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, this vulnerability is not considered automatable, which slightly lowers the immediate urgency compared to network-wormable flaws.

Analyst Recommendation

Security teams should treat this access control flaw with high priority. Upgrading to version 3.0.21 is the only effective way to ensure that access restrictions are correctly enforced and that user data remains protected.

---METADATA---
VENDOR: bigbluebutton
PRODUCT: bigbluebutton
AFFECTED_VERSIONS: < 3.0.21
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
BigBlueButton is affected by a vulnerability involving the use of insufficiently random values, which may allow an authenticated user to bypass security controls.

Executive Summary:
An insufficient randomness vulnerability in BigBlueButton versions prior to 3.0.21 could allow authenticated users to compromise sensitive session information.

Vulnerability Details

CVE-ID: CVE-2026-46351

Affected Software: bigbluebutton bigbluebutton

Affected Versions: < 3.0.21

Vulnerability: This vulnerability (CWE-330) stems from the use of insufficiently random values, which can lead to predictable identifiers. The attack requires the user to be authenticated, meaning the attacker must first gain access to the system.

Business Impact

Predictable values can allow an authenticated attacker to hijack sessions or gain unauthorized access to virtual classroom data. This threatens the confidentiality and integrity of user interactions within the platform. With a CVSS score of 8.1, the potential for unauthorized access requires prompt attention to ensure the safety of academic or corporate communications.

Remediation Plan

Immediate Action: Upgrade to BigBlueButton version 3.0.21 or later to resolve the randomness issue.

Proactive Monitoring: Review application logs for suspicious access patterns or session activity that deviates from established user behavior profiles.

Compensating Controls: Ensure that all administrative access is protected by multi-factor authentication to reduce the likelihood of an attacker gaining the initial access required to exploit this flaw.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on authentication for exploitation limits the attack surface but does not negate the impact.

Analyst Recommendation

Organizations utilizing BigBlueButton should move quickly to apply the 3.0.21 update. This patch corrects the underlying cryptographic weakness and secures the platform against potential session-based attacks.

---METADATA---
VENDOR: Mastodon
PRODUCT: Mastodon
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical security vulnerability has been identified in the Mastodon social network server, necessitating prompt remediation to protect instance integrity.

Executive Summary:
The Mastodon social network platform is vulnerable to a high-severity flaw that could permit unauthorized actions or data exposure within the server environment.

Vulnerability Details

CVE-ID: CVE-2026-46348

Affected Software: Mastodon Mastodon

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Mastodon server, which utilizes the ActivityPub protocol. The flaw likely resides in the handling of network requests or user data, potentially allowing an attacker to bypass security checks or manipulate server-side processes.

Business Impact

With a CVSS score of 8.7, this vulnerability presents a substantial risk of unauthorized access or data manipulation. For organizations hosting their own Mastodon instances, an exploit could result in the compromise of user accounts, leakage of private communications, or the total takeover of the server instance, severely damaging organizational reputation.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the Mastodon project immediately upon release.

Proactive Monitoring: Monitor server logs for anomalous ActivityPub traffic patterns or unexpected administrative configuration changes.

Compensating Controls: Deploy a WAF configured to inspect and block malicious payloads targeting ActivityPub endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The high CVSS score underscores the urgency of this advisory. Administrators must treat this as a high-priority task, ensuring that all Mastodon instances are updated to the most recent secure version to mitigate the risk of exploitation and maintain platform security.

---METADATA---
VENDOR: oscal-compass
PRODUCT: compliance-trestle
AFFECTED_VERSIONS: >= 4.0.0, < 4.0.3, < 3.12.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The compliance-trestle platform is vulnerable to multiple path traversal flaws, allowing unauthorized access to files outside of restricted directories.

Executive Summary:
The compliance-trestle platform is vulnerable to path traversal attacks in versions prior to 4.0.3 and 3.12.2, potentially leading to unauthorized file access or modification.

Vulnerability Details

CVE-ID: CVE-2026-46345

Affected Software: oscal-compass compliance-trestle

Affected Versions: >= 4.0.0, < 4.0.3; < 3.12.2

Vulnerability: The application suffers from improper limitation of pathnames, including absolute path traversal and external control of file paths. This allows an attacker to manipulate file operations, potentially leading to unauthorized data disclosure or system-wide impacts.

Business Impact

Path traversal vulnerabilities can allow attackers to read sensitive configuration files, source code, or internal system data. With a CVSS score of 8.4, the risk of total technical impact is significant, potentially leading to a full compromise of the local environment where the tool is running.

Remediation Plan

Immediate Action: Update the compliance-trestle package to version 4.0.3 or 3.12.2, depending on the current branch in use.

Proactive Monitoring: Monitor file system access logs for attempts to access directories or files outside of the expected application path.

Compensating Controls: Run the application with the principle of least privilege, ensuring the process owner has minimal access to the underlying operating system files.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the nature of path traversal flaws.

Analyst Recommendation

The existence of a proof-of-concept makes this a credible threat. Users should verify their current version and apply the appropriate update immediately to prevent unauthorized file system access.